Prepare for release v3.106.0

[alessandrarizzo]

Background

Changes

Testing

[cursor]

PR Summary

Medium Risk
Medium risk because it adds many new security detections and deprecates/removes others, which can change alert volume/coverage and pack composition. Workflow action version bumps may also affect CI behavior.

Overview
Detection content update for v3.106.0. Adds multiple new rule-based detections (and supporting index/coverage entries) for AWS CloudTrail/RDS security signals (e.g., console password spraying, suspicious GetSigninToken, IMDS credential use from public IPs, and several RDS abuse/evasion/destruction events), plus a new aws_rds_context helper to standardize RDS alert context.

Deprecates/disables several older scheduled queries/correlation rules (e.g., S3 security-controls correlation rule, various scheduled query-based sprays/scans, and some Dropbox/GSuite/Kubernetes scheduled rules) and updates packs/indexes accordingly; also replaces Okta AD “pantherflow baseline” lookup tables with new SQL-based lookup table definitions (30/90/180d windows).

CI/automation maintenance: bumps GitHub Action pins (configure-aws-credentials, claude-code-action, github-script, action-create-branch, fork sync action) and makes minor lockfile/metadata housekeeping changes (e.g., Pipfile.lock index fields, deprecated.txt entry/newline).

^{Reviewed by Cursor Bugbot for commit 7b2f2b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7b2f2b0. Configure here.}

[cursor]

Deprecated rules missing from deprecated.txt tracking file

Medium Severity

This commit adds AWS.S3.Disable.Security.Controls to deprecated.txt but omits six other rules that also receive Status: Deprecated in the same commit: VPCFlow.Port.Scanning, CloudTrail.Password.Spraying, GSuite.Drive.Many.Documents.Deleted, Kubernetes.SecretEnumeration, Dropbox.Many.Deletes, and Dropbox.Many.Downloads. Notably, GSuite.Drive.Many.Documents.Deleted is the only rule in this batch being changed from Enabled: true to Enabled: false, making its omission from the deprecation tracking particularly impactful.

Additional Locations (2)

• queries/gsuite_queries/gsuite_drive_many_docs_deleted.yml#L3-L5
• queries/aws_queries/anomalous_vpc_port_activity.yml#L12-L13

 

^{Reviewed by Cursor Bugbot for commit 7b2f2b0. Configure here.}